Aaron Thummel

I’m a cybersecurity professional and perpetual student of the craft, with a strong incident-response and detection-engineering focus. I bring a highly analytical, engineering mindset to protecting remote-first, cloud, and on-premise environments—combining deep log work with clear, stakeholder-ready communication.

I’ve been SOC-oriented for 6+ years and a generalist across IT/security for 20+ years. Across enterprise and cloud environments, I lead triage, investigation, and remediation of complex security events as the primary incident lead—reducing triage time to minutes instead of hours and containment time to hours instead of days/weeks.

I build repeatable defenses by developing and optimizing incident response playbooks, operational procedures, and detections-as-code workflows. I’ve integrated security tooling (including Cribl) to improve visibility and operational efficiency, while conducting security assessments and risk analyses to drive concrete security outcomes.

I also lead people and process: mentoring teams, running tabletop exercises, and supporting compliance initiatives such as FedRAMP and SOC 2. From incident debriefs and root-cause analyses (RCA) to vendor contract maintenance, I help mature security capabilities and turn lessons learned into measurable defensive improvements.